feat: add Phase 3 — Runners + manage_runner.sh

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phase3_teardown.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# =============================================================================
+# phase3_teardown.sh — Tear down all runners defined in runners.conf
+# For each runner: calls manage_runner.sh remove to stop and clean up.
+# Clears GITEA_RUNNER_REGISTRATION_TOKEN from .env since it becomes useless
+# after all runners are removed.
+# Safe to run against already-torn-down runners (no errors).
+# =============================================================================
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "${SCRIPT_DIR}/lib/common.sh"
+
+load_env
+require_vars GITEA_INTERNAL_URL GITEA_ADMIN_TOKEN ACT_RUNNER_VERSION
+
+log_warn "=== Phase 3 Teardown: Runners ==="
+
+RUNNERS_CONF="${SCRIPT_DIR}/runners.conf"
+
+if [[ ! -f "$RUNNERS_CONF" ]]; then
+  log_info "runners.conf not found — nothing to tear down"
+  exit 0
+fi
+
+# ---------------------------------------------------------------------------
+# Step 1: Remove each runner via manage_runner.sh
+# manage_runner.sh handles its own safety (skips already-removed runners).
+# ---------------------------------------------------------------------------
+printf 'This will stop and remove all runners. Continue? [y/N] '
+read -r confirm
+if [[ "$confirm" =~ ^[Yy]$ ]]; then
+  while IFS='|' read -r name rest; do
+    # Skip comments and blank lines
+    [[ "$name" =~ ^[[:space:]]*# ]] && continue
+    [[ -z "$name" ]] && continue
+
+    name=$(echo "$name" | xargs)
+    log_info "Removing runner: ${name}"
+    "${SCRIPT_DIR}/manage_runner.sh" remove --name "$name" || true
+  done < "$RUNNERS_CONF"
+  log_success "All runners removed"
+else
+  log_info "Skipped runner removal"
+fi
+
+# ---------------------------------------------------------------------------
+# Step 2: Clear the registration token from .env
+# The token is single-use in some Gitea configurations — generating a new one
+# on next deploy is safer than reusing a potentially stale token.
+# ---------------------------------------------------------------------------
+if [[ -n "${GITEA_RUNNER_REGISTRATION_TOKEN:-}" ]]; then
+  save_env_var "GITEA_RUNNER_REGISTRATION_TOKEN" ""
+  log_success "GITEA_RUNNER_REGISTRATION_TOKEN cleared from .env"
+fi
+
+log_success "Phase 3 teardown complete"